feat(cli): implement -G to dump the resolved configuration

[inureyes]

Part of the OpenSSH drop-in compatibility epic.

Problem

ssh -G destination resolves the full configuration for that destination and prints every effective keyword and value without connecting. bssh does not implement it. The regression suite uses it 104 times across 1074 traced invocations, making it the second most-used flag bssh lacks after -E.

It is also the cheapest possible lever on this epic. -G needs no network, no sshd and no authentication, so it turns the entire ssh_config resolution layer into something testable in isolation. cfgparse, sshcfgparse, cfgmatch, cfginclude and percent are all config-resolution tests, and three of them fail today (cfginclude with "FATAL: ssh config parse failed", cfgmatch with a hang, sshcfgparse with "failed to reparse minimal").

Outside the suite it is the standard way an operator answers "which key, user and port will this actually use", and the standard way tooling introspects ssh configuration.

Scope

• Add -G, resolving the effective configuration for the destination and printing it, then exiting without connecting.
• Match OpenSSH's output shape: one lowercase keyword per line, a space, then the value, with multi-valued keywords repeated on separate lines. sshcfgparse reparses bssh's own output, so the result must be a valid config file that resolves to itself.
• Apply command-line overrides, -o values, Match blocks and Include directives before printing, since the point of the flag is to show the resolved result rather than the file contents.
• Print keywords bssh does not implement as well, so -G reflects the parsed configuration honestly. This flag is the natural surface for the "consumed or declared unimplemented" invariant from the keyword-wiring sub-issue.

Acceptance criteria

• -G prints the resolved configuration and exits 0 without opening a connection.
• Output is a valid ssh_config that reparses to the same resolution, verified by a round-trip test.
• Match, Include, -o and command-line overrides are all reflected.
• The regress tests cfgparse, sshcfgparse, cfgmatch and cfginclude pass in the harness.

Part of #275